A computer network is a collection of interconnected computing devices that can exchange data and share resources. In a packet-based network, such as an Ethernet network, the computing devices communicate data by dividing the data into small blocks called packets, which are individually routed across the network from a source device to a destination device. The destination device extracts the data from the packets and assembles the data into its original form. Dividing the data into packets has several advantages including enabling the source device to resend only those individual packets that may be lost during transmission.
The packets are communicated according to a communication protocol that defines the format of the packet. A typical packet, for example, includes a header carrying source and destination information, as well as a payload that carries the actual data. The de facto standard for communication in conventional packet-based networks, including the Internet, is the Transmission Control Protocol/Internet Protocol (TCP/IP).
A system administrator or other user often makes use of a protocol analyzer to monitor network traffic and debug network problems. In general, a protocol analyzer is a tool that captures data from a network and displays the data to the user. The protocol analyzer typically allows the user to browse the captured data, and view summary and detail information for each packet. Accordingly, the user can view the network traffic between devices on the network.
The number of devices within conventional networks has increased dramatically in recent years. A large number of enterprises, for example, have geographically dispersed operations, and typically have a local area network (LAN) supporting the information processing needs at each of these locations. These dispersed operations may be connected by leased lines or virtual private networks (VPN). Accordingly, the network traffic within an enterprise has increased in volume, as well as complexity. Furthermore, a typical enterprise network may have a number of routers and switches that provide alternate routes for traffic flow. Consequently, conventional protocol analyzers do not provide sufficient insight into traffic conditions across large networks.